Cannot ping to fortigate vlan interface

[laldana]

I have a Cisco core switch which is the one in charge of routing the internal traffic between VLANs everything in the internal communication is working fine I mean VLAN 20 has communication to any other VLAN in my organization nevertheless  I added a VLAN interface in my Fortigate 600C with FortiOS 5.0 build 0271 Patch 6

config system interface     edit "VLAN 20"         set vdom "root"         set ip 10.1.20.2 255.255.255.0         set allowaccess ping https         set snmp-index 35         set interface "port1"         set vlanid 20     next end

when I try to ping from a pc in the subnet and VLAN 20 gaves me the following error:

# diagnose debug flow show function-name enable # diagnose debug flow filter addr 10.1.20.3 # diagnose debug flow filter proto 1 # diagnose debug flow trace start 100 # id=13 trace_id=549 func=resolve_ip_tuple_fast line=4299 msg="vd-root received a packet(proto=1, 10.1.20.3:1->10.1.20.2:8) from VLAN 20." id=13 trace_id=549 func=init_ip_session_common line=4430 msg="allocate a new session-09c10f2f" id=13 trace_id=549 func=fw_local_in_handler line=360 msg="iprope_in_check() check failed, drop" id=13 trace_id=550 func=resolve_ip_tuple_fast line=4299 msg="vd-root received a packet(proto=1, 10.1.20.3:1->10.1.20.2:8) from VLAN 20." id=13 trace_id=550 func=init_ip_session_common line=4430 msg="allocate a new session-09c10f73" id=13 trace_id=550 func=fw_local_in_handler line=360 msg="iprope_in_check() check failed, drop"

The interface from the core switch to the fortigate is in trunk mode. 

I have read that when you add a subinterface in the fortigate you dont need to add a static route in the fortigate in order to ping to internal network, since is directly connected to the switch core.  Is this correct?

What am I missing here?  

Thanks in advance, 

[Anne · Accepted solution]

Have you put any IP restrictions on trusted Hosts for your admin accounts?

[laldana]

Thanks Anne,  that was my problem. 

By the way any advice in communicating VLANs. 

I have multiples VLANs and my core switch is routing all traffic through native VLAN 1 to the WAN through  a physical interface in the Fortigate for example port 1 with ip address 10.1.0.90 in the same port I created the VLAN 20 and VLAN 30  Interfaces.

I have already created policies from VLAN 20 to VLAN 30 and vicecersa in order to test inter VLAN communication with no luck I cant ping to VLAN 20 interface in Fortigate with an Ip address 10.1.20.2 from a PC with ip adress 10.1.30.3 in VLAN 30. 

Thanks for your help.

[Anne]

Would you be able to draw it on a piece of paper and upload here. That will help us to understand the scenario ..

Just checking, Have you installed the Fortigate in transparent mode??

[laldana]

Anne thanks for your help. 

I have created a new thread.  

VLANs cant go to the internet. 

https://forum.fortinet.com/tm.aspx?m=122896&tree=true

I appreciate your help.

Best Regards,

Luis